Last year Yii was chosen to be in session 3 of the GitHub Secure Open Source Fund as a project that impacts a significant part of the PHP landscape.

We were in good company together with many wonderful projects such as LLVM, Node.js, CPython, curl, ImageMagick, webpack, and jQuery.

It was quite an experience. We've verified that we were already doing well and learned and adopted new things. As a result, Yii became an even more secure base for your projects.

Yii Security version 1.2.0 was released. In this version:

• Add PasswordHasher::needsRehash() method
• Add PHP 8.5 support

We've turned on immutable releases for all our repositories at GitHub.

Immutable releases are releases where the assets and associated Git tag cannot be changed after publication. They increase security by blocking:

• Supply chain attacks where attackers inject vulnerabilities or malware into current project releases
• Accidental changes to assets and tags that may break developer workflows

If you use gh command line tool, you can verify integrity of the release.

We have fixed a security issue in 2.0.50 but there were additional issues so complete fix was done in 2.0.52. We have not properly assigned a new CVE for it and considered additional fix as:

Bug #20232: Fix regression introduced in GHSA-cjcc-p67m-7qxm while attaching behavior defined by __class array key (erickskrauch)

That was not correct and now there is a separate advisory: CVE-2024-58136.

Thanks goes to Nicolas Bourras & Thomas Reynolds from Orange Cyberdefense.

Version 1.1 of Yii Security package was released. There are some improvements and changes:

• Bump minimal required PHP version to 8.1
• Change PHP constraint in composer.json to 8.1 - 8.4
• Use SensitiveParameter attribute to mark sensitive parameters
• Mark readonly properties

Today we are releasing several versions for Yii 2.0.x and official extensions to fix a security issue.

The problem addressed in these patches exists in ActiveRecord shortcut methods findOne() and findAll(), which may allow SQL injection if input is not prepared properly. We consider this as a security issue in Yii because the documentation for these methods did not contain an explicit warning that there are cases when passing unfiltered user input might be dangerous. Thanks to analitic1983 for making us aware of the issue.

The nature of this issue does not solely exists in the Yii Framework but depends on how an application uses Yii. We have changed Yii to be more robust against the worst impact of the problem (SQL injection), but applications may still be vulnerable and changes to application code are necessary in some cases. As a safety measure, findOne() and findAll() are now limited to filter on columns that are AR properties only. In the following we will explain the problem in more detail and show which application code is affected and what needs to be adjusted on upgrade.

Recently three security vulnerabilities in PHPMailer and SwiftMailer have been announced:

• 25.12.2016, CVE-2016-10033 Remote Code Execution vulnerability in PHPMailer
• 27.12.2016, CVE-2016-10045 Remote Code Execution vulnerability in PHPMailer
• 28.12.2016, CVE-2016-10074 Remote Code Execution vulnerability in SwiftMailer

Credits to Dawid Golunski (https://legalhackers.com) for finding these.

We are releasing Yii 2.0.5 to fix a security issue found in the yii\web\ViewAction class. We urge all users of the class to upgrade their Yii installation to this latest release. Upgrading from 2.0.4 to this release is very safe as the release does only contain the bugfix for the vulnerability and will not break your existing code.

The vulnerability is in the ViewAction action. It is possible to execute any PHP file (a file ending with .php) on the disk by passing a relative path via view parameter. Since the issue was posted on the public issue tracker and is already known, we've fixed it and decided to make this release immediately.

We have reserved a CVE number (CVE-2015-5467) for this issue, which you can use to refer to it.

We are releasing Yii 1.1.15 to fix a security issue found in 1.1.14. We urge all 1.1.14 users to upgrade their Yii to this latest release. Note that the issue only affects 1.1.14. All previous releases are not affected. Upgrading to this release from 1.1.14 is very safe and will not break your existing code.

The vulnerability is in the CDetailView widget. When a Yii application uses this widget and configures the "value" property of a CDetailView attribute using end user inputs, it may allow attackers to potentially execute arbitrary PHP scripts on the server. We are not showing how to exploit it here to allow users to upgrade before details about the exploit become publicly known. To our knowledge the details of this issue are only known to core team members.

We have reserved for this issue a CVE number (CVE-2014-4672) which you can use to refer to it.